search

npxTSC / Sparklet

Personal pet project site. Perpetually under maintenance. <3
https://sparklet.org/
3 stars 0 forks source link

CSRF Protection for admin stuff #35

Closed Lamby777 closed 3 weeks ago

Lamby777 commented 1 year ago

Haven't even made a UI control panel yet, so this doesn't really apply right now, but later on, there should be anti-CSRF measures to prevent any old Joe from sending an admin a sussy link to one of the /cpl routes.

Lamby777 commented 3 weeks ago

No longer relevant. Control panel is gone for now, and all important requests are done over POST and cookies are marked HTTP Only. Not sure if there are any other ways to harden against CSRF for now, but maybe will revisit this when adding an admin panel again after Rooms is complete